dataprotection.ie

Ireland's GDPR regulator — the body that has issued billion-euro fines against Meta, Google, and TikTok. 79 requests, 3 domains. The Cookie Policy states: no third-party resources. The HAR records a request to code.jquery.com. One external domain against one statement — and the statement is inaccurate.

Timeline of the leak

+134 ms · before any interaction

code.jquery.com — the jQuery UI CSS loads from the external jQuery Foundation CDN. The sole external domain in the session.

Set-Cookie — zero

None of the 79 requests sets a cookie via Set-Cookie. Cookies are also absent from outgoing requests. No session cookies are recorded in the HAR.

Indicators of GDPR non-compliance

GDPR Art. 13(1)(e); ePrivacy Regulations (SI 336/2011)

The Cookie Policy states: 'dataprotection.ie and its subdomains do not use any third party or persistent cookies.' The HAR records a request to code.jquery.com (+134 ms) — an external domain belonging to the jQuery Foundation (USA), loading before any user interaction. The policy's statement does not match the technical fact.

Context

The DPC (Data Protection Commission) is Ireland’s data protection authority, the national GDPR supervisory body. It is the DPC that has issued the largest fines in GDPR history: Meta — €1.2 billion (2023), Instagram — €405 million (2022), WhatsApp — €225 million (2021). HAR: 79 requests, 3 domains — 77 to the first-party domain dataprotection.ie, 1 to the subdomain www.dataprotection.ie, and 1 to the external domain code.jquery.com.

One request against one statement

The DPC’s Cookie Policy contains a direct statement: “dataprotection.ie and its subdomains do not use any third party or persistent cookies.” The HAR records a request to code.jquery.com at +134 ms — jQuery UI 1.13.2 CSS, loaded from the jQuery Foundation CDN (USA). This is an external domain, not one belonging to the DPC. Every visitor to the site transmits their IP address to jQuery Foundation’s servers, whereas the policy states that this does not occur.

The scale matters here: this is the sole external domain, a single request, one CSS file. Not a tracker, not analytics, not an advertising network. jQuery UI could be hosted locally — a standard practice for organizations with privacy requirements. The violation lies not in the nature of the resource but in the gap between the documented statement and the technical fact.

What has been done correctly

The site’s architecture is, on the whole, minimalist: 77 of 79 requests go to the first-party domain. There is no Google Analytics, no GTM, no advertising networks, no Google Fonts, and no cookie banner (because there is nothing requiring consent). Set-Cookie is zero across the entire session. This is substantially better than most sites in the Irish series, including the CSO.

Documentation accuracy

A regulator that fines companies for discrepancies between their declared and actual data-processing practices allows precisely such a discrepancy on its own site. The Cookie Policy was last updated in August 2023 — after that date, the connection to an external jQuery CDN either went unnoticed or was not considered significant. Under the standard set by Art. 13(1)(e) and the ePrivacy Regulations, documentation should reflect the actual set of external connections. The fix is technically trivial: host jquery-ui.css locally and update the policy.

Conclusion

dataprotection.ie demonstrates one of the cleanest architectures in the Irish series: one external domain, zero cookies, zero analytics. The sole violation is a formal one: the Cookie Policy declares the absence of third-party resources, whereas one such resource is present. For a regulator whose job is to ensure the accuracy of data documentation, this is precisely the kind of discrepancy that should not appear on its own site.

Evidence

Original (audit)

HAR file: ie/dataprotection-ie-2026-05-31.har

SHA-256: 5c090a7d974e84616c37cf736da03df306d721dbaa1e74de900e267d76dba59f

Re-check snapshot

Awaiting changes

HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.

Ready-to-send complaint letter

Where to file: Data Protection Commission (DPC) — dataprotection.ie

To: Data Protection Commission (DPC)
From: [Your name], [contact email]

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website dataprotection.ie.

2. Circumstances
I visited the website dataprotection.ie and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 31 May 2026 (open methodology, reproducible measurements) documents the following indications:

1) The Cookie Policy states: 'dataprotection.ie and its subdomains do not use any third party or persistent cookies.' The HAR records a request to code.jquery.com (+134 ms) — an external domain belonging to the jQuery Foundation (USA), loading before any user interaction. The policy's statement does not match the technical fact.

Full technical documentation is published at: https://gdpru.eu/en/audits/ie-dataprotection-ie/

3. Provisions violated
GDPR Art. 13(1)(e); ePrivacy Regulations (SI 336/2011)

4. Request
I request that you investigate the violations described and apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

[Date]                                    [Signature / name]